Hey Product Hunt! 👋 I built this after my third phone migration in two years. Google Authenticator gave me no way to move accounts between devices without exporting one QR code at a time, and every "cloud sync" 2FA app wanted an account and an email address attached to my most sensitive codes. So this one keeps everything in the browser. TOTP Authenticator generates 6-digit codes entirely client-side with the Web Crypto API — secrets never leave the page, there is no server call, no analytics, no account. What it does: • Add accounts by secret, otpauth:// setup URI, or QR code scan • Live codes with a refresh timer, copy button, per-account algorithm/digits/period • Password-encrypted backup (.73hi.enc, AES-256-GCM) you can restore anywhere What's not great yet: accounts live in memory only — closing, reloading or switching language clears them, so you MUST download the encrypted backup before leaving. That's the honest tradeoff for zero-upload. QR import needs a photo of the code (no camera stream in some browsers). Feedback I'd love: how you handle account migration today, and whether an optional local-only sync (no cloud) would matter to you.

TOTP Authenticator

Local 2FA codes in your browser — nothing ever uploaded

Local 2FA codes in your browser — nothing ever uploaded